Varnish Controller 7.6.0 Release

• Support for wildcard domains (e.g. *.example.com). Wildcards follow TLS (RFC 6125) semantics. They match exactly one label, and an exact domain always wins over a wildcard.
• Rolling upgrades can now be paused, resumed and stepped manually.
• Invalidations can be given an optional name.
• Varnish Enterprise licenses can now be distributed to all agents through the controller (vcli license varnish add).
• Secure filesystem permissions for controller-created files (files 0640, directories 0770 with setgid). Default for new installations. Components existing before the upgrade keep the legacy permissions (see the upgrade notes).
• The UI server gains SSO login through the organization’s IDP, controller-managed TLS certificates (including ACME), and configuration broadcast from brainz over NATS. Several of its configuration flags were renamed or removed (see the upgrade notes).
• Router health output now includes the endpoint score (vcli router health).
• gRPC routing plugins now receive score, latitude and longitude for each endpoint.
• The agent logs when it enters and leaves maintenance mode.
• Fixed a panic in the traffic router when a gRPC plugin was reconfigured under traffic.
• Fixed health probing of agents whose root VCL lacks the health check include, which are now probed per domain instead of being reported unhealthy.
• Fixed deploys not always applying the latest VCLGroup, so domain changes could be missed.
• Fixed configuration sync after a brainz restart or an agent or router transfer.
• Fixed TLS certificate loading so one bad certificate no longer prevents the remaining certificates from loading. The failing certificate is quarantined and the error reported on the deployment.
• Fixed agents to re-fetch their deployed VCLGroups if the agent base directory is wiped clean.
• Agent and router names derived from the hostname are sanitized into valid names. Explicitly configured invalid names are rejected at startup.
• Fixed the traffic router flooding DNS with repeated requests for unknown domains.
• Fixed parsing of = characters in configuration file values.
• Updated dependencies to address upstream security advisories.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.